Google disrupts IPIDEA residential proxy networks fueled by malware

Google Threat Intelligence Group, with industry partners, disrupted IPIDEA — one of the largest residential proxy networks — which used trojanized Android apps (600+ apps embedding proxy SDKs) and thousands of trojanized Windows binaries to convert millions of consumer devices into proxy exit nodes. The network operated multiple consumer-facing brands tied to a centralized two-tier C2 infrastructure (roughly 7,400 servers), and was abused by hundreds of distinct threat groups for account takeover, credential theft, brute-force attacks, botnet control and record-setting DDoS operations; Google provided takedown actions and shared intelligence on the SDKs and infrastructure.